Skip to content

rec: implement DNS cookie support for outgoing requests #15412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 22 commits into
base: master
Choose a base branch
from
Open

rec: implement DNS cookie support for outgoing requests #15412

Show file tree
Hide file tree
Changes from 16 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
70d292e
Initial very raw version
omoerbeek Feb 5, 2025
fd9a851
Tidy rec-tcpout.??
omoerbeek Feb 18, 2025
93d896a
TCP support for cookies, taking into account idle outgoing connections
omoerbeek Feb 18, 2025
33c30b0
Add setting, remove debug lines
omoerbeek Feb 19, 2025
e9fe4ab
Basic cookies test: enable cookies in rec and talk to auths with cook…
omoerbeek Feb 19, 2025
90ab1be
four states: unknown, supported, unsupported and probing
omoerbeek Mar 21, 2025
395ad57
Invalid cookie case, plus test of moving to next NS in that case
omoerbeek Mar 21, 2025
8ac61af
Better tracing
omoerbeek Mar 21, 2025
2014d49
Fix regression tests
omoerbeek Mar 24, 2025
a4ecbdc
Refactor cookie code out of asyncresolve
omoerbeek Mar 25, 2025
fc18cb2
Add metrics for cookies
omoerbeek Mar 26, 2025
d9a26a8
Comments and docs tweaks
omoerbeek Mar 26, 2025
94cd6d5
Reformat
omoerbeek Mar 26, 2025
e2c80fe
Fix ifdef botch
omoerbeek Mar 26, 2025
86b0c8c
Typos in comments and docs from Miod
omoerbeek Apr 30, 2025
b5384b2
Tidy
omoerbeek Apr 30, 2025
8686ee8
Typo
omoerbeek May 9, 2025
8c1f41d
Use ostringstream for constructing cookie displaystring, add a few co…
omoerbeek May 9, 2025
007af59
Apply suggestions from Habbie (the trivial ones first)
omoerbeek May 9, 2025
71eed99
Implement EDNSOpts::getFirstOption and use it in lwres
omoerbeek May 9, 2025
950ee2e
Factor out the code to compute the EDNS Error code
omoerbeek May 9, 2025
1ec4c30
Better naming of cookie metrics
omoerbeek May 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions pdns/ednscookies.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,29 @@ string EDNSCookiesOpt::makeOptString() const
return ret;
}

string EDNSCookiesOpt::toDisplayString() const
{
std::string ret = makeHexDump(client, "");
if (!server.empty()) {
ret += '|';
if (server.length() != 16) {
// It isn't a rfc9018 one
ret += makeHexDump(server, "");
}
else {
// It very likely is a rfc9018 one
ret += makeHexDump(server.substr(0, 1), ""); // Version
ret += '|';
ret += makeHexDump(server.substr(1, 3), ""); // Reserved
ret += '|';
ret += makeHexDump(server.substr(4, 4), ""); // Timestamp
ret += '|';
ret += makeHexDump(server.substr(8, 8), ""); // Hash
}
}
return ret;
}

void EDNSCookiesOpt::getEDNSCookiesOptFromString(const char* option, unsigned int len)
{
client.clear();
Expand Down
2 changes: 2 additions & 0 deletions pdns/ednscookies.hh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,9 @@ struct EDNSCookiesOpt
[[nodiscard]] bool isValid(const std::string& secret, const ComboAddress& source) const;
void makeClientCookie();
bool makeServerCookie(const std::string& secret, const ComboAddress& source);

[[nodiscard]] std::string makeOptString() const;
[[nodiscard]] std::string toDisplayString() const;
[[nodiscard]] std::string getServer() const
{
return server;
Expand Down
1 change: 1 addition & 0 deletions pdns/recursordist/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,7 @@ pdns_recursor_SOURCES = \
ratelimitedlog.hh \
rcpgenerator.cc rcpgenerator.hh \
rec-carbon.cc \
rec-cookiestore.cc rec-cookiestore.hh \
rec-eventtrace.cc rec-eventtrace.hh \
rec-lua-conf.hh rec-lua-conf.cc \
rec-main.hh rec-main.cc \
Expand Down
5 changes: 4 additions & 1 deletion pdns/recursordist/RECURSOR-MIB.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,15 @@ IMPORTS
FROM SNMPv2-CONF;

rec MODULE-IDENTITY
LAST-UPDATED "202408280000Z"
LAST-UPDATED "202504290000Z"
ORGANIZATION "PowerDNS BV"
CONTACT-INFO "[email protected]"
DESCRIPTION
"This MIB module describes information gathered through PowerDNS Recursor."

REVISION "202504290000Z"
DESCRIPTION "Added metrics related to cookies"

REVISION "202408280000Z"
DESCRIPTION "Added metric for too many incoming TCP connections"

Expand Down
79 changes: 77 additions & 2 deletions pdns/recursordist/RECURSOR-MIB.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,15 @@ IMPORTS
FROM SNMPv2-CONF;

rec MODULE-IDENTITY
LAST-UPDATED "202408280000Z"
LAST-UPDATED "202504290000Z"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(not for this PR really)

should this .txt be in git at all? it is generated

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We refer to it from docs, so it needs to be somewhere.

ORGANIZATION "PowerDNS BV"
CONTACT-INFO "[email protected]"
DESCRIPTION
"This MIB module describes information gathered through PowerDNS Recursor."

REVISION "202504290000Z"
DESCRIPTION "Added metrics related to cookies"

REVISION "202408280000Z"
DESCRIPTION "Added metric for too many incoming TCP connections"

Expand Down Expand Up @@ -1291,6 +1294,70 @@ tcpOverflow OBJECT-TYPE
"Incoming TCP limits reached"
::= { stats 152 }

cookieMalformed OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Malformed cookies received"
::= { stats 153 }

cookieMatched OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Matching cookies received"
::= { stats 154 }

cookieMismatchTcp OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Mismatched cookies received over TCP"
::= { stats 155 }

cookieMismatchUdp OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Mismatched cookies received over UDP"
::= { stats 156 }

cookieNotInReply OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Authoritative server sent a reply back without cookie"
::= { stats 157 }

cookieRetry OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Retries because authoritative server sent a BADCOOKIE reply"
::= { stats 158 }

cookiesSupported OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of authoritative server IPs marked as supporting cookies"
::= { stats 159 }

cookiesUnsupported OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Number of authoritative server IPs marked as not supporting cookies"
::= { stats 160 }

---
--- Traps / Notifications
---
Expand Down Expand Up @@ -1489,7 +1556,15 @@ recGroup OBJECT-GROUP
maxChainLength,
maxChainWeight,
chainLimits,
tcpOverflow
tcpOverflow,
cookieMalformed,
cookieMatched,
cookieMismatchTcp,
cookieMismatchUdp,
cookieNotInReply,
cookieRetry,
cookiesSupported,
cookiesUnsupported
}
STATUS current
DESCRIPTION "Objects conformance group for PowerDNS Recursor"
Expand Down
3 changes: 3 additions & 0 deletions pdns/recursordist/docs/manpages/rec_control.1.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,9 @@ dump-cache *FILENAME* [*TYPE*...]
select specific caches specify one or more *TYPE*s, separated
by spaces. The value of *TYPE* can be r, n, p or a.

dump-cookies *FILENAME*
Dump the cookie store.

dump-dot-probe-map *FILENAME*
Dump the contents of the DoT probe map to the *FILENAME* mentioned.

Expand Down
19 changes: 17 additions & 2 deletions pdns/recursordist/docs/upgrade.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,23 @@ Upgrade Guide
Before upgrading, it is advised to read the :doc:`changelog/index`.
When upgrading several versions, please read **all** notes applying to the upgrade.

5.1.0 to 5.2.0 and master
-------------------------
5.2.0 to master
---------------

New Settings
^^^^^^^^^^^^

- The :ref:`setting-yaml-outgoing.cookies3` setting has been introduced to implement cookie support for contacting authoritative servers and forwarders. See :rfc:`7873` and :rfc:`9018`.

:program:`rec_control`
^^^^^^^^^^^^^^^^^^^^^^

The ``dump-cookies`` subcommand has been added to dump a table showing cookie support for each
authoritative server contacted recently.


5.1.0 to 5.2.0
--------------

Changed behaviour
^^^^^^^^^^^^^^^^^
Expand Down
Loading